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(54) SYSTEM AND METHOD FOR ANALYZING ILLEGAL ACCESS ROUTE 
(57)Abstract: 

PROBLEM TO BE SOLVED: To realize intrusion route 
analysis which is applicable to intrusion using a 
steppingstone and intrusion using a false transmission- 
source address. 

SOLUTION: A packet gathering device 104, etc., records 
the header contents of a packet sent through a network as 
header information and a host internal information gathering 
device 111, etc., gathers internal process information 
regarding internal processes of a host 112, etc. An intrusion 
route analyzing device 124 receives the header information 
and internal process information and a data management 
device 123 manages data as a database; when an intrusion 
packet is detected, the transmission source of the intrusion 
packet is detected by using host level analysis and router 
level analysis in combination and when the transmission source of the intrusion packet is a host 
in the network, a packet which contributes the generation and transmission of the intrusion packet 
is specified by taking host internal analysis of the host to analyze the intrusion route by using the 
three analyzing processes in combination. 
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[HUH] tt*£**H>fc«A, *flS7K^S:B* 
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(7)^a/nt^l:ov>TSfMl$:fToT, ^FIET^ir 
;*/n°>t$, h^^^UJ^fg^^firbfc^i^^Pir^^^F 
3ET h±j&i£ff :/pir;*£ ITitiit^^ 

^pir:*##rM:)®^££^U 
JtfJEi£«7G«*ffitea«&ti:, 

Ortffl^n-fe^^oi^rWW&aSSrfTl^ ^FIET^ir;* 
« 1 K Km <D^flE T * ir ;* S B&Wflr * x A 0 
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y hearts Tco^iinaasrfTt^, Er^cos^ic, 
Ran, 

E«ft7c1*ffi*&3l«fc: <fc «9 ^tb ^ nfc^— ^ 

^FiET^ir;*/^;y h^i^ 
fT 5 r. £ £ ^ -T S ixii2 KE* (D^aET ? 

ft ^<z>^— ^ (7) 3fl ^ ta ir j* o V > Tflf «f 

^ic, ttriaft^^^-^^S^g^^FiET^ir^co^^ 
^^Jlrtl) r. <h £4$t» ^"**S»*Ji l ~ 3 to^-TfiMz 

t It, ^FjET^-fer^/^y h4r*«L)t^^s/ h *M 

7u £ ft -r 6 m - <o & m % $ a * 3® t , 

4#«£-*-«!*3Mll — 3^^-fix^{c|5ifc<^^FiEr^-fe 
5t? ffl*a3®(cj: ^^a^n/c^-^^^^gOf^^^pi?^ 
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IB « o >F IE T * -t? ;* S & ft «f v- * x A c 

^ h s?— * *mm-r y hSrisaiu jr^il 

(WEiSfll 7C *t HI 13 , 

-5 1 1 t> , 

ME*— 0»«7c*fctt*l3»i: It, 

* ;ft5«$ST-& oT i^ffjcE t h e r T F'^, 
SftEtherTFl/^St/TTL (TimeTo L 
i ve) ffi&*tt««fc:£<5*, lffll5*«&tf>^ ^HWR 

ft 7CE t h e r T Kl^*, £S5fcE t h e r T Kl/^RV 
E t h e r T F>^, 252c E t h e r T Kl^^MTT 

ft 7c^«tti-rs r. t zmmt-tzm #m s [cfsa^iE 

^FIET^ir;*/^^ Hc^Six/tiJHS tc I P7 K^l: 
& £ -f 5 If *JR 5 (c |E« <D* IE T * -fe ^ S &«#r > 
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[1***1 2] miErta^p-fe^**jR*ajtt. 
10 *igi 1 (cisaco^iEr n^gssif^T 1 ^ 

-fe^WWtafi-rsr i:«:«M»i:-*-ai»3R*l l t-lBtt 
o^jET^-fer^SSSWWv'^x^o 
[W*JB1 4] iTJfB^IET ^t^gS&S?ff^f^ 
s> h !7 — ^ Srfl#*itStt^IE7 ^ -fe 

±*s*try h<ommK<Dfem&fcm+z&mfem*:T£m 

-T Z> r <^ S: W« ^ i" 5 If * XR 1 (C IS ft co IE T 9 ± X & 

ISfil-M LT^FIET ^-tr^^^«^ y h 3ft*aS« ZtitiMG 
T, 

5(9 mife^ftTc^ffiM^^^^^icj: 
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r, ^FIET^i?;*^* ho*fi«;R^iS«S:|gfTLfcrt 
B^uir^^lET^-t?;*^^?/ h flferitaSfS ^ n ir ;* £ 

pir^^Wl, tfcHbfcmiB^^s/ hSft^o-tr^^ 

[0 0 0 1 ] 
[0 0 0 2 ] 

[t£#WSffi] H 2 2000-3413 

1 5*5j:Wil 2 000-12495 2 7^2*1 fc/^ 

-To 02l:^^r, 2 o l liSSf 2 0 2i^y 

*-^yh, 2 0 3tt«»#*»5Rd«a:**ttUTl^*r 
^ir^if — 2 0 6 J*IB^£*;* K 2 1 1 liT-IE7 
^-tr****** K 2 10I^A«f, 2 0 4. 2 
0 5 I2#^if 2 0 1 ^p3B^-&*7 h 2 0 6— 60^ 

h&*«Lfci6l*SStt 0^—*) > 2 0 7, 2 0 
8, 2 0 9 h^fe^FIET ^i?*****;* h 

Bl*^*^ h 2 0 6 tttfflt 8 C t ? 
h 2 l l lc^ur^«#«^o#7c$rBijR 
LT^FIET fir o X co if5 0 

[0 0 0 3 ] COJ: 5 ^^*0«Ai6l»^^xAtc*5tN 
^IET h 2 l l h 

2 0 6*t s (7>ii8*<i:!S^-&*^ h 2 0 6*^ 

2 0 1 *-COil«!»3l3fl«a»O«»*:as 0 fcojfcPBfc: 

121 2^i6*jftKJi^#ffi-rS**Wi&«:8« (/U- 
'MlW&Jf^U ^Sft^feS b^^r05fe(7>iil» 
(/is— & ) -^i6«:4r»«-rSi:W^o*:**'Wftia(|! 
fcJ>*H-a£fcr**#tt*2 o l*t»*«Lt^« 
T?1zx-9-—'<2 0 3 *-Ci6Bf«:fr3. 
fl»5fc2 0 1 ^ir^i^— /<2 0 3 0*IKn^S: 

[0 0 0 4 ] H 3 0-164064 
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e 

— v^, 302, 303, 304 litHfrtt/ — hV 3 0 

bft*«y-K3 0 3 SrB^iLT, K 3 

0 4~FjEfcT ^*^S:ffoTt>5 t><^£-r£ 0 

7(7 [0 0 0 5 ] CCDJ; 9 <Ct**(7>ftAi6l»^^^^«ca3t^ 
HI 3 coff-3S«>>— K3 0 3 — K3 0 

4^»««rS#Lfc»£\ W-»«y- K3 0 4tt, SR 

^-T6o fHS«y-K3 0 3tt, ««4:5*Lt^5ff 
K 3 0 3±(7>^D"t^(7>»SiJ^^ff3S«y- K 
3 0 3 ©BISU-T-SrfHWI/ — K 3 0 4 ^15 0 l^«*># 

K3 0 4±^Coyti:#, *y h ? — — 
20 t30 l«W-#«y— K3 0 4^f)Wt* a yf^i^ 
M]H»*n 3 0 6 £r§tf Sc «9 , - K 3 0 4 ±{CfS 

tW«y- K3 0 4 fc0ttMRtt«*M^*fc-@rS. 
tHS«y- K3 0 3TM2, tM*«y- K3 0 4 ^*>»ffi 

K3 o 2 *>b 5je»**ufc:/n 

^^30 1 — iifcrT <5o &tc^s> h 17 — **tm-v* — i? 
t301tt, W-JWiy- K3 0 2^ffttfiBttH<D|fl^ 
J» MW^tf»y-K3 0 2 ^IE^7 

[0 0 0 6 ] 

[RRMIKfeLJ: 5 ttSKJi] «6*«>«^«*»*f^ 

*y-J±(D 5 2000-341315 ^lU^^M 2 

000-1 24952 (C^^nfctXDli, fr y h CO^ 

ffi, B^Sr^LfcaWcoi^rtt, fiSS^-&^^ h<7>A 

Pp1JH^^*>o7t 0 hB^)«tt 
0- 1 6 4 0 6 4) ttAfiKiUK^d^^^NKr 

tS^hmSBiw^tKIl h 



T 

[0007] d^JBWrJJilBOj: 5*IB«A*:**-r« 

[0 0 0 8 ] 

JET ? ± *&&<DMft&ft ?^&T ? ± xm&MVr->'X 

ent, ^iET?±x/<try b&mto-rz'**? h^m 

tit* SMB^y hK««fc<fc D^piET j/ h 

[0 0 0 9 ] HtjfE^FIET ^t^gKHWr^fAtt, H 
affile* V^jET y ho^fttotl^ 
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[0010] miBiSfS SlfcttifeafflRtfffiErtSff^ni 1? 

[ooii] miBrtffl^n-fe^^wteaiWtt, W^T* 
[0012] itfjfB^FjET ^■fe^a»l!¥«f^^7 l AH: 1 

ft Tt^^yj-r z>%-<omm Tztk&t&m t z&n ittr o 
[ooi3] mum-<vmmfcfem&mtemum-<n& 

5^7 -So 



9 

[0 0 1 4] miB^FIEr^-fc^aftiWflr^^AW:, S 
E*s> h !7 — ^tiHt6**©^J/ h*rJfc*U JR 
*i:bTE»U BB»Lfc**(7>^^yi»««:(WIEiSfS 

flr7c«ui*aa»tt. mia^y hjr*«j: diwib**© 

hCO^^^|C^^ixS'ff«r*^or^ff 7CE the 
r T K I*"* , ?6$fcE t h e r T K l^&TJT T L (T i 
m e T o Live) tt&*0>1fttt(c£<5* % mB«ft 

i^^a £i%5i£{f 7t E therTK^, ?a5fcE t h e r 
7 K^XyTTLilSrMt Ltitlj^^fiSI^ 
£ix£i£ff TtE the r7K^> 2S&E t h e r T K 

[0015] mE&fflr 7c«fcHM3®ffl5te, miEjB— (Di^m 

ft 7C I P7 K^CS^, ^JET fry b <&t£ 

[0016] Wlte'** y hJDUftSPte, mumiarcfeftte 

[0017] WE'**- ^ hJR*«W[, fitjEi^fgTc^ttiM 

[0018] ME5FiEr^-fe^a»W«rS/^^Att, jg 
-fe^«cBa-f5««*rtas^o-fe^ilMBi: bTJR*U JR 

*bfcrt«B^o*^*«*#i[Ert»^o*^*w*3a«B 
^iSft-rsrtw^o-fe^flMajR^iafe^-b, mE^as:/ 

lWErtW^n-fe^««S:gflr-r5i:i:t^, SflTbfcrt 

fta^— ^*aass«ort«^o-fe^»«sraiRb, 

bfcrt«^B*^«**rffll^rrt»^o-fe^*P«r»a«: 

[ 0 0 1 9 ] SiiErtfflS^cj-fe^WftiR^lffltt, fflts^^ 

d -fe^««(OJR*S:fT ?Z.t Zftrnt-fZo 
I o o 2 o ] iftErtffi:^ni?***iR3i95te> iffiEi*iffi 

«^o*^#Wtea»«C^bTfflErt«rn-fe^'|»««: 

[0 0 2 1 ] WE^iET^ AW:* to 

h^-^SrWa^ftt-rSteo^FiEr ^-fe^fiK 
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Ztlltfo^y h? — ?^JET?-£Xs*fry b <D 
t?«ffi#tt*aftbfc»-fr*c, Bm&fffTGttttH&a** 
tt, «E*afifcJB^#*nfcmE«*y h!7--^5FjEr 

[0022] SMB^FiET t^xmfoMtiri/^TM-t. ftH 

3ft*»3e^^r ^-t?;*^^ hjco^riSfs 7c^«ifflT- 

#^^o)t^(c, «rEffio^iEr^-tr^a**«f^ 
^AlcWbTiTOEWJe^iEr^*^^^^ h^iSfsTC 

[0 0 2 3 ] *«K(c«S^FjET ^-fe^SK8f»*f*-«fe 

tiau^*-* h«sft*fr^#«**^-**a 

8«*£t*»ffi*>* «/ h 7-?&<§mttMtt U ME* 

b9 — * Zffim-rZ'S'r y hOTU ?FiET*-fc;*/* 
hSU^r yT'lzX V^lETt'tx^fr y btmtoZti 

WS^—^ttaStHSr^FET^-fe^^-Sr^ h <£>i£ff 5c 

tffiMI^f^^J: D»*<o^— ^&a*S«^jEr 
^ir^x-^/r ^ b<D^it7tt br^tb^ix^^^tc, fflG 

ir^/^^^z hco^RT^iSff SrHtTb^rtS^n-t^S: 

££t>tc, Er5£ WfE^FjEr^-fer^^^-y 

b, «ffltt(»E/^y hSm^Dir^^^^TSff ^ 
^ tifc^^s^ h^r^FiEr ^-t^^y 5/ ItBfitfirt 
a5^uir^««rMa^x^^<i:^*b, SUIS^fa^^fcH 

J: V^IET t"£X/*fry KD«3e3ft«fTt>nfc»-&U:, B 
[0 0 2 4 ] 
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t-££ (^toW5) . m^&^-c, ioii3#^# 
<t>c*, i o 2ii*»f i^y^-^sx h^(Sirt> 

1 0 3 13 ^ y V , 10 7, 113, 1 

1 9 J3^~ ^ , 105, 108, 115, 120 I3« A 
*&£o£SS, 112, 118 h, 111, 117 13 

hrt»w«jR&ssfi, 104, 109, ii6, i 

2 ltt/^ix hiR*Ktt, 106, 110, 114, 1 
2 2tt*^*j/ h !7 — 1 2 3 1 

-^13** h (««-5T) i:^:Oteo*fig«il*(cJ:or^ 

1TM3, ffH^ffiUJi, /i— ^, hfc^<D«#«r« 
5t>C0T-f3ftt\ H<a*R«^ffi«fc3Sa>Eofl£ 
*?, *fSl o 5/ hJR*3S««ri2«-r So £ 

Bd^ffi-rstot-rso iic/TtSAft^fio 

5, 108, 115, 120, h rt95fi?*RiR3l3£e 

111, 117, A*^r y YUMUW: 1 0 4, 1 0 9, 1 
16, 121, §AS^«ffgS 1 2 4 (c J: 19 *gj*£*i, 

[0 0 2 5] Il^^T, SAf*Ugf 10 5, 10 

8, 115, 12013, ^ix-fn^warfenfc*^ 

^A'^y h (^FIET ?±xs*lry hXl3#$£^^ 
s> h£t>i^5) ^t^o «A^^D^gi3, /^s> h 
HSi" So fc*3. Bltett^LT^Jfct^ * 
*hll2, 1 1 8C0rtffl5^n-t^|gtTtt«S«:£«b, 

B*^S«»lw«atS. hrt«1**tt*S6«i l 
1, 1 1 7 13, *ti*:ti&tt&t't'Z>*x hcoft^u 

FW[f*£SA^«W^Sl 2 4->iSff5o h 

So y V^M^W 104, 109, 116, 121 

13, *tl?tlfr1&1$E£tlX^Z>V-7*y h9-?±trffi 

^^rta^-rso um^t^yy<Dfr®&^yy-mmtv£ 

SASMWSf 1 2 4 {3, hitlMmWX Kf^y 
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-5#** hftwrnvtzftoo « Aiwst 1 2 4 
«3, iSft5c*ffite3a«^rt«^o*xwffja3s«jcffla 

-r«So /u— ^ U"</i^*P*f, ^^hK;H!ftr, * 

112, 1 1 8 f3, v* — ^M^SI^lc, /u— ^ 107, 

113, uQwt^^htniRiicfflats. 

[0 0 2 6 ] W:tffil:o^tRMt6. fiAl 
KfitfrgC 12 4 ^«AfiK*«f SrfT 5 fc«> 

^ «HJ:S**iR*S:fT5. '«^s> 0 4, l 

0 9, 116, l 2 l ntti^rtit^m^thXi^^^ 
t>^hI7-M 0 6, 1 1 0, 1 1 4, 1 2 2«tl5 

ffll^tl^/^j' y¥\*KO&m teE t h e r T K U 
ther7F^, ICMP^ah =r/l— ;y 
^COType, Code, Checksum, IP^n 
h 3 j/^WI dent i f i ca t i on, TTL 
20 (Time To Live), Protocol, 51 
f&7C I P T F>^, JBJfel P7 K^, TCP/UDP 

Checksum, TCP^o h ^ ^^(7)S e 
quenceNumber, Acknowledgme 
ntNumber4if(Z)«a*§tp. #*hrt«**UK 
H£lfil3>^^ h±<0^ut^f IftSi: LT, ^Dir^ 

ilft^T0S#, iifg$fe i p r ilff5feTc 
p/uDP^h##, iiftN i ctcfij y> irbnr^ 

fcEther7K^iIP7F^, TCP/UDP 

[0 0 2 7 ] «ASS&W*f«« 1 2 4 13, ^ h 

^ 105, 108, 115, 1 2 0^f)(O«AW«S^ 
«*Lfc»**^ SSj^fc(3#K(cJ:or^AS5§fi?W 

t^T, «A«*PW*J£*mjc/<^ hilX^I$ie 1 0 4 , l 
0 9, 116, 1 2 ltW:, hrtWW«JR*S5« 

ill, ii 7 iz£^T&M£ti>f^~?te, izmmz. 

[0 0 2 8 ] nrr*l3, gll^^{c, H4Sr#B8Lft*« 
b, ifAS^«^r^®l 2 4Tfif*3ixS«AffiiS»«f^ 

5^ ^^-yy^o^rRSts. 0413, gA^s^fl? 
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«f*4r$*A-i; >?&Z:ti*:tl<D#tiTft&m (414, 
4 15, 4 16) Jbl£*L£:fc <5 0 m 4 lc£>^ 

T, #P#rB$5fc?U (414, 415, 416) ±<7D^^r^ 

[0 0 2 9 ] l> i^^<yuj|f«rW:, SA^^oggia t> 

ici^^, h^s^s 

#?5 e '*>ry h^fcktliRFC (R e q u e s 

t for Comments) T^L^^iX 5 J: 5 ftii 
fS^a h = /H^iS tt ^fe t^^ ^ 5 J&^jlWrtft 5 o 

/^y h^j/^««l^*nS«it7Cl P7 K 
i^tfSWSHc*-/ h J7-^-^««-5TllBft I P T F^t 
5 J&»fcifff>IB3lE (DNS(^>#S^/^5/ FPJSI 

»B"CWW«3a3ft«j»T-rSKffi, I P T Kl/^^f^ 

t)iSft*ix^^yy««^5*>iS«5cE t h e r 
T F M, ^5$feE ther7F^, TT LlcS^ N 

;h,7t*;* h<7>rtffi:/ni?;*#«£A¥#rU -too** 
ir^rttc, h^Sft Lfe/^jy ho3%«A^ 

^ ho^^^ft (cgg-^-Lfc/^^ h&j»5rrs# 

[0 0 3 0] 11 <DmAm&M#r mW: 124 teJ^T^fl? 

¥*TLT^fT-f6 (401, 409) 0 ^CO 
h U^<^#P*flttT^ (402, 403, 404) , Jt<D 

4 0 1 -eBBtt^ttfc*^ h U"</HMfM» 
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i^Tcl^^ hrt«»«f*rM4&-rS (4 0 2, 4 0 
4) o *o{fi*>»-&«:*;* hrt«»*r«rWJttLfc^ (4 

0 3) o A'— ^ l^^#?#T*£TB$ (410, 411, 4 
12) , Z<D/i'—*\/^/i'M$rtm&lz.ffl1fe£titz*x 

✓^j, h Fco^ffjcE t h e r T F'^^o 

h cor K^^;^ i^A'JWflrfcMfcsf?:*— t L7c 

ff^WtS (411, 412) o *Ofi!l J* 

hrtW*«f«rMttL&^ (4io). HPSlc 

(4 12) left, hrtfflSWW^D-tr^Sr^T-r 
6 (4 0 7) o fc* hrtffi##r&T3# (4 0 5, 4 0 
6, 4 0 8) , *xbft9ll&$r<oj<j3t\^lZ'*fryh$: 

5 (4 0 5, 4 0 6) o *r<Dttk<Dm&1*fcX b Is^JUM 

JO #f, $ is^/isMtir t <>{c:IH*&L^v^ (4 0 8) . r 
T^^t (4 13) 0 

[0031] ::r-, g}4 (c^LfcW{co^T«Etft-r 

7^ix-5»#f ^ 4 0 8 r^7t5««f^i^r, b 
«Atfe*aSS«)&^«A«l*aai*Dd«*>t?, 4 0 1M4 0 

4 0 2 {C*5^T^^ h 

L, h U"<yu»9f^8*, «A^^s^ hoi^ffjc^ 
x b<D\,^-rtifi>fr1fem£tiZ> 0 **5. ^Ttii, SA8 

^h^ta-fo 4 0 1~4 0 2^^^hU^SIr 

50 T'^tl3^nt^7 h^rt^ts^ hAiW^ 6 4 0 
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5 0 — 4 1 0tc£>^TA— * ^/^ff^^TtS 
ffi^Wtt^<^££l£fT£*L£o 4 0 5T, ^^hP^a5« 

win, rt**^ hA^SfSb/c^^^ h^p^e 

^/^»Wi:3d s lpl^J-H!*6SnSo 4 l ilcfc^T, A— 
^ i^/u»tffjft*^T U ?v— $ U"<^J!ttr©JB*, «A 

h Bcoft^^air^^^f-o^T*;* hF*l3ff$? 
«fd«M*&$nSc — 4 0 3f, h ix^/u$?#r^ 

*«:«5fcU 4 1 1 -CjSfTSixfc*;* h^95#F«f^rffiJBc 
-f£ 0 4 0 6T-, ^hrtW^TU F*lffl5*;* h 

? i»s<suf»9r t&mmzMf&ZtiZ* 4 0 4f, h 

So — 4 12T*, y^^i/^jfW^Tl, 

Co^T/t^ hrt»W*rft (4 0 7) o M4(D 
f'ltll hW^gl, rt*B** h 

cot*, hD!:S«f «*^tWSf ^)«* 

HTtl>i^^LT^5 (4 0 8, 4 1 3) 0 
[0 0 3 2 ] /U — ^ l^Ag?^<7}MJS^)i[I{COt^ 
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t h e r T K l/^&t/T T L £rR£#ttA^<^ y h<D^y 

r T ^SSfcE ther7F^, TT L^H^T^ 

[0 0 3 3 ] H5 tC*5t^*t\ 501*^ 5 0 51^:*^ 
b . 5 0 6 ^^ 5 0 8 tt/l — ^ , 5 0 9*^5 12 

3> h 7 — *, 5 13)5^5 161^^^ 
JR^ISS®, 5 17l4ftA**D8t, Mld^MUtt* 
SS^SOE t h e r T H>^^^LT^5o 
[0 0 3 4 ] 06 IcrJoi^T, 60l3J»b613 fit-tit-?: 
^ iX0 5CO^^ h50 1^b 5 0 4 <7}§f 4 0<Z)*;* h £>b 
^^h 5 0 5 (Ether7F^:Mll) '^s<fr y 
b<D^yV^^< ^Ll^ (EtherT F'U^MTT 

*08f 5 1 7^W5/^yh 6 0 8, 6 0 9, 6 1 
2, 6 1 3 <Dfflna»fcfc»*— £ Ltf-^^^ 

fcfTorwbttfc^sRtt***-*-. fc«u Bern 

» bnfc«5R«*fc— * TTLllci:o r 

LTfB*LT&>£ 0 ^^tiMRIiflSllJb, ^ffjcEth 
e r T F>^, ?5$fcE ther/K^, TTLlt, 
J<? ^rtibeA^^'ff^ (^^^ hOfcSRfcJfl^fc, I CMP 
"/o y #<DT y p & y Code, Checks 

u m, I P h ^yoidentificat 
ion, Protocol, ^ff t£ IP7F ^% 
IPTKU^, TCP/UDP/p hnyU/s^yoifl 
7C ^ — h #■§*, ^n^fe^K — Checksum, T 

C P ~f n h 3 iy^OSequenceNumbe 
r, Ac knowl e dgmen tNumb e r ft if 

So I7|:i3^r, 701i^i6^/^s/h 6 0 9^ 

Ife, 7 0 2UH6O/^s/h612 y h 6 

13) i: LTA—* U"</u*«r«rfTofc«A 

[ 0 0 3 5 ] ::r-|l mG<F>'* / ry h 6 0 9CO/U— ^ 

^yu*«f*:fT5 irtco-TSo h6 o 9i*** 

— £ LTT-^^-^ti^ofc^l^r I P^n h a 
;K7)TTLtlcJ:ot^It6^i6 0J: 5 ft#ffia*» 

bnSo 

[0 0 3 6 ] ^-^-<-^^^(cJ: 
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h 5 0 5*TC0jgS&±t*«, a?*- 3, hCO?g$fe IP7F> 

*a*3:fBL 5, HOTTLii^ft/hiftSiilcj: 

So It^ot, TTL(ttLt7*fto/^yh6 1 

[0 0 3 7 ] TTLli^^j/ h 6 0 9 £ |r) 8(7>t 

^^h 6 0 9 £$gff tcE t h e r T Kl^^tl/C, 
E t h e r T Kl^^^«bl^^y«»«J&l^O'N.jyyfl| 
6. Lfc^oT, /^^h610^^s/h 

[0 0 3 8 ] SCTT L(t^9^y^lHaiCO^tte 

l^^^^DMB S> h 6 0 9 ) <nmt 7t;E t h e r 

X Kl^Srftpoyu— * 5 0 8i^o^tOE t h e r T 
FlsX&m^Z* ^(Dt$, /U — ^5 0 8 liM 1 0 tM 
9SEther7F^i: Lr(«o:^*j5^ e #C 
(d, TTLffl^9^i>SI$nS^^^'lta^5*,, Ml 
0IMM9^*E therTK^i LtWo/^ 
5/ h 6 0 7 ZmtRL, » D ?:«itSo Lfc^ot, 
>/- ;y h 6 0 5 , ^ h 6 0 6 , '*tr ^h 6 0 8ij:, C 

[0 0 3 9 ] TO:, TTLll:9^0/^i/hT*g 
oT^5^^yft8 h 6 0 7) tcE t h 

e r T K l^M8 tEther/F^i: 
^ 5 0 7^^po^TC0E t h e r T K^Sri^So C 
/U — ^ 5 0 7 I3M8 iM7^Ether/F> 

^iirj^or^^^So ftc, TTLffi^ioM 

h e r T F'U^i LT^o/^ ^ h 6 0 3 £51*R U » 
9 £r*£l£-r£o LfctfoT, j/h60l, y V 

602, /^^6 0 4ii ::r*f-^^ifg 

[0 0 4 0] TTLlCl 0^^FO/^«7 hT'goT^ 
S^^AUR h 6 0 3) <7>38fS tcE t h e r T 

K^M3 S:Ether7h v ^i lt»o^-^^tS 
O^Ether/K^^^Sc Lj&>Lfcj&*&, 
M3li/U-^^oE t h e r T K /£^fc#>, 
M3tEther7F^i: It fto;U-^ tel&ttj £tl 
ftt\ T% s/ h 6 0 3li, Ether7F^ 

M3£*#o*J* h 5 0 3 *>feS§f&£jh,fc£E&r^-r5o U 
/t2*oT, /^5/h 6 0 9lj:, h 5 0 3**ib»fS* 

ix/u— ^ 5 0 7*5j;tM^-* 5 0 8lcJ;oT*M£n* 
^ h 5 0 5 — %m Lfc <bt^5, 117(7)701 <Z>jB*2*f# 

[0 0 4 1 ] 06(D/^yh612 ( t> L < ^ h 
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6 13) ^B8bT±fBCOfti3aS:fifofc#-&li, ®5<Z>* 
^h50U h 5 0 2 t> \Z./*fr y h (DftitftX 

h^ir^^n, H 7 co 7 o 2 <7>£ 5*«**»&n 

So 

[0 0 4 2 ] J^_b*> cfc 5 fc, * l^^^*«ftt, 

yFolP7 K^CJ: k-f£?#r£fT5<z>T-, IP7F 

10 [0 0 4 3 ] m^te, H8S:#SSLfe^fc«A^^^ 

5o 0 8l£:i8^T, 8 10ttt^h (BS^-gf) ,801 
frb 8 0 7 13*;* h 8 1 0±T-^iii^nfc^ p Dir^, 8 
11, 8 12 f^^^^g, 8 0 8 lj:^^^f 8 1 1 £ <D 
aflMfcOTc, 8 0 9Wc^ffl»«8 l 2 i:oafS«cttfflS 
tLfc^^. h 8 1 0 Ji<7>aff tf— h SrSLT^S, 

nt^8 0 l^^Pt^ 8 0 7<^^:il ftfKD^ni? 
^^J:orjB»**ifcil!li:jB«iUfc«li:t^5, 

ic&l^T, :/Pi?*8 0 5, 8 0 6 13, 

^8 0 4CJ;or^i^iiTi / ^ 6 :/ni?j* 

8 0 S&^U^n-fcr;* 8 0 6^^Dt^8 0 4 (D^^xp. 
ir*, ^nt^ 8 0 4^7 p nt^ 8 0 5, :/Pi?^80 
6^^n-t^ kVf-Xo UTii, h 8 1 0 li^-Sfige 

®8 1 l^^«f8 1 2 ~^3££fT 5 

[0 0 4 4 ] fAM^W^f 8 1 2COffi03&^ffl3»co 

t>txX& *) , y h 1**^ h 8 1 o 

ft*- h 8 0 9d^<b«m$iXitr ttmi££ixX\i^Z>h 
(Dt-T&o ro^r^, -^CD/^^ h*»BW«T3»5R*— 
t irf-^^«il, -tOBSPflfc*^ M10 
Oiiff h 8 0 9 ir^ot^ (^^^^h 

ir^^T0P#, ^n-ir^gftSU^, W^o-fe^BISU^, % 

40 aft$fe IP7F^, MftTCP/UDP^- h 

aftN I C{:^J «9 ^T^>tLTl^cE t h e r T K 
U^^IPTKU^, TCP/UDP/f-h#f) £rf# 

**Mi6afflr«:«itUTV^fc»-fr (/^s; hSff^n 
-t^^tr^ixri^c^-^) t3, M98^B^ afS)»T 
0 0#, aft % I P7KI/^, iff^TCP/UDP^- 
h#-§-, aftN I C(Cf"J«9 itbiir^ltE t h e r T 
Kl/^i I P7F>^, TCP/UDP^-hf#^ 

50 ittot/^j/h^tSo ^ (7>4#5EL3t^^2y h 
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h 8 1 0 CO*^/^ h tt/^ 

W»*3&»bo»IK{cj: 5ifift*»itLT^fta>ofc»'& 

[0 0 4 5 ] hfefiK^n-fe^^ffllKS^bO* 
mz£Zmit&fa&\^X\,^tz7*^X&&^frZ>l)\ a 
:/p^*;ds^jt£nfti/^ni?j* (^-^l^-t 1 ^ >^v- 
*xA<Z>^£iJft:/nir;*) ULTtir _bIB<Z>*i 

[0 0 4 6 ] B80Wttt, ^P-fe* 8 0 3 ^^ffKt 
fe 0>«jSi J; 5 flfflt £r*fe:fc LT v o ir ;* t ft -5 fc 
8 0 3(cgg-T Ltr- 
*"<-*£:8SsRL, ^n-fe^ 8 0 3 2fl**«3£«a>fe«tf 

[0 0 4 7 ] h^^^^air^'ISffi^r^O^A^^-r 

±1B y b<Dffim&Vm*.j3h'tZ*X h l*3«5#*f 

[0 0 4 8 ] £L±.<D£ o (C, h U"^*?*?, /l— ^ 

W«rtt*<7>E*ttSriRliE Loo, ^iCSAl^ 

t P f gm-t m Z>1z#> + ^7 h i/^/i/j)?lT, A'— 9 i^^/KWW 
*S8«IH-Ciiflr«rtT^ft3&*b, SKif^i — 

[0049] mm<nj&m 2 . ^±<omm<omm 1 t-is, 

»*«c*5tt*«A^HLTt>ifiWBriBi:-rafc«>«c, * 

-T^o L^Lft^b, »At5^f^(DStlcJ:or 

i>mi,^m&hhZtiib, £XT<D£ 5ft#ftl-J: QXt 
**S:E«t5^itt#6. IB*-*"**'**- 

{z.m^hix&^'r y b~-y ¥^<nmtjtK t h e r T K 
l^*, ^Q^feE t h e r T K l^^, I CMP^n h a/U-^ 
^ycOType. Code, Checksum, I 
D h =r -/^^Identification, TT 
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L, Protocol, «ft 7c I P7K^, I P 

TF^, TCP/UDP^n h3^5/y<7)^ff7C^ 
— h#-f§\ $q,%tS— h##, Checksum, TCP 
^ u f> ^ A"^ i/ycOSequenceNumber, A 
cknowl edgmentNumber) 

[0 0 5 0 ] SX±<D& f^^t5f-^(7)fi^ 

[0 0 5 1 ] HJfeOftm 3 . a±<0**0»J| 1 afctNc 
**^»«2-CWt, ^ft< t *«WfcfT3«»fc:*3^T 

20 ««AfiK»«f*ctt**S:Xff$ft^ 0 U^ot, * 
i^Bttft<, «A«»*«r«:4?toft^^#«cWt, *^^r 

[0052] ^jbco^j^co^^3 tdctm*, 

?*g&%iW:-t<DV y-^(c^-r^»A^f (IBtt«4KS*% 
[0 0 5 3] ^1^14, Bl±co^JIS<7>^1fi3"C»*, 

[0054] j£XJbo^ife(z>^fii4 ianii, ^^hi7- 
hrtW««JR*««±^«A«K*W«i3a*r»tkLrv^ 

50 iz.*x h_h(c^^^nr^7c#-^, atfc^FiEr 
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[oo55] mm<o^m 5 . £t±.(nmm<Di&M i-4t- 

[0 0 5 6 ] 09 {C&V^T, 901, 902, 903 

-tn*nHft<5«ABKJ!¥*r*6«, 9 0 4, 9 0 5, 9 
0 6 l4**U*n«A«KW«rSS« 9 0 1 , 9 0 2, 9 0 
3 tfBKWff^tefc-* * 9 0 7-910lif 

<ht>, 0 1 tc^Lfc J: 5(c, ftA^^o^g, ^^s/hiR 

h 9 0 8*5 &Tf&X h 9 0 9 3rK^-&£ Lt 
h 9 1 0S:*WL7tt>^i:*t*So 
[0 0 5 7 ] «Aill&8?W$Se9 0 3 13, ftlM^ftT- 
«AfiB*«fS:tTofcjB*, *^h9l 0 ^(D^jET? 
-K^^Ty H3, gASMf^i9 0 2tC £oTii^ 

A8&3WSHS9 0 3 11 *5> h P — * 9 0 5*^b*y 

ffi^ffi^if A^SS«?^r^® 9 0 2 ICi^fHb, {fAi&S£fl? 

[0 0 5 8] *tB««BS:S«Ufc«AftK*«f8fa9 0 
213, «Aft»*«r»«9 0 S^biSbttTSfc^^-x 

Al^«r$rtT9o *y h*-* 9 0 5jb*> 

h 9 0 8*3^^^^ h 9 0 9 J&SB&^-pT £ ^JtifcC 
£ , jfetWi , h 9 0 8 I^SASMffgl 9 0 1^ 

H*«f«*«:«A8H*«ftt1K9 0 3 [ci^mf <5 Q 

[0 0 5 9 ] «A8SSS?«r^S 9 0 3 13, t!ASS&«#r 
gf9 0 2 OffffttAtC'&Stue , {&A8&*#r3sie 9 

gf90l ^jSflTU ^AS^»^r(7>M^^ft«S-r5o 
[0 0 6 0] SA8SS»«r^e 90in, if Aig&&» 
(fKt 9 0 2 fcimicftAglMHr«rffv\ «ffi<fc*g<o 
<feofc^s> htt, h 9 0 73&>fc»ftSj|xfc:£i:*: 
»SU *«ftt**«AS»»«T««9 0 3Jci»flr-t- 

[0 0 6 1 ] S^ftttC, SASU&flflfgf 9 0 3tt, * 
y h !7 — ^ 9 0 6 0»#f»S, 4f ASg3&S?#r£$ 

S9 0 2, {fA8&§*#rgE§9 0 1 7&><bi£{f ZtlXZfz 
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h 9 o 7;&»b*^ h 9 i o iT^-ao 

[0 0 6 2] SilJiOJ81l[<D»lB5«cj:*t«, A 

[0 0 6 3] »-b«> 1^5 -Ctt, 

A) fcoi^TRBUfc**, ^co^^l 1 ~ 5 ^ Lfc#L 

[0 0 6 4 ] rrr-, nm<omm 1 ~ 5 itgAS 

[0 0 6 5] HJ6<Z>fl£1tS 1 ~ 5 *f S'* 

2. t> L< 13, g»fcL< 
13, U ^i/-f^fy/^rAiaor 

f3, *MW*^«»«^ia«k^-^*iSfii-s*^ hrt 

3. h i?-^ Jitc#^-rs^^-^ hiixsgMt; 

4. ^88W»b^Sr$fttL<tt, Stbt>L< 
*3, #«rcjg»u ^^h^HSfSfSi, 

IB) o 

5. ^s/ h7-^i«ti5^s/ hS:Stlt> L< li^ 
^ ^hOrtMMgHt^^^T'fA^L, t^ol 

[0 0 6 6 ] SSlfe<?5^}» 1—5 tC^-f ^A8SS»*f v-^ 

TTL (Time to Live) y*— ^ , i^f§7CE 
t h e r T K^M^C, ^SftE t h e r T K^^ffl 

m tff -r ^> r ^ &4#tt* <^ -r 5 . 

[0 0 6 7 ] mM<r>ffim 1-5 (c^-rftA^SSAf^rv'^ 
5<9 hW»ff^$rfT5^^$r»fi*^t5o 
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[0068] mm<o?&m i ~ s tc^-r eA&&«?*f v-* 

T«AR» SrWaffc-r £ C ^ «:4»ftt £ -T 5c 
[0 0 6 9 ] 

[#91ttSfi*] Woj:5^> **KtcJ:n«, SHItc 

5o 

[0070] m-^^ff7c«ffi 
[0 0 7 1 ] **Wfctn«, b<DUMR 

[ 0 0 7 2 ] Sfc, *«9§K«fcntf, ^^ftSMrt 

<E>© 

[0 0 7 3 ] *&m\z£*i\$. W&<o*y h !7- 



/0 
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[0 l ] «AftB*«f^^A«)^fAf«««:* 



[02] 
[03] 
[04] 
[B5] 



[16] ^s/y'»«oWS:«i-BI 0 
[0 7 ] /u— * u^</uj|¥*r«)«S*oWS:«-*-H. 
[08] hrtttWWWtrRW'fSfcabo^o-tr^ 
Si©0o 

[0 9 ] «»(DSAI8»«f^^r AfcJfl^fclWrW 
[»**>R!fl] 

10 1 10 2 i&S&, 10 3 

— *;xK 104 hfl*3£SSfi* 10 5 «A« 

*0SS«, 106 ^^f^yVV — Z , 10 7/^, 1 

0 8 «a«*dss«, 109 hjr*{|8«, 11 

0 *y~7*y , 111 hrt«5*«iR^IK 
S, 112 K 113 /u— ^, 114 

S/h?-^, 115 «A^*0igI@, 116 h 
IR^^S, 117 hrt«1*»fc*i£«, 118 

K 119 /U— 120 SA^^gf, 12 

1 <^s> hflX*^fi, 122 *jr-f*yVy — 9, 1 

2 3 ^-**3iSS«. 12 4 fiAlSS«^Tgfo 
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